4 matches found
CVE-2026-112329
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...
CVE-2026-112329
The Sensei LMS WordPress plugin, versions prior to 4.26.4 , is vulnerable to a broken access control issue in the legacy save_new_message handler hooked on the init action. The vulnerability exists because the handler validates only a generic nonce without verifying course enrollment or restricti...
CVE-2026-112329 Sensei LMS 4.26.4 Broken Access Control via save_new_message
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...
EUVD-2026-104388
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...